conventional-changelog-preset-loader

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, so the release's publication origin is less verifiable than it could be.

Repo toolingcaution

The project uses TypeScript, Vite, and npm build tooling, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Workflow auditcaution

All five workflows were analyzed with no high-confidence audit findings or untrusted checkouts, but all 37 action references are unpinned and one workflow has top-level write permissions, creating avoidable workflow-integrity and permission-hygiene risk.